@corbits/system-one

Typed choice, score and yes/no decisions about a JSON state from TypeSafe's Jev model, returned as a validated result or a typed fallback. An inference provider for Corbits and Interchange agents: registers as an @intx/inference adapter, and also works standalone through evaluate().

1. Typed decisions, not free text. You send questions with ids; you get back one validated decision per id, with probabilities and confidence. No prompt parsing.
2. Failures are data. A missing key, timeout, HTTP error or bad body returns a FallbackResult with a reason, so a gate can fail closed without a try. Only invalid caller input throws.
3. One call, many questions. Every question in a list goes out in one POST, bounded by a 1.5 s default timeout.

It evaluates structured state against questions. For open-ended chat completions, use a general inference provider such as @corbits/openai-responses.

bun add @corbits/system-one @intx/inference@^0.4.0 @intx/types@^0.4.0

Runs on Bun >= 1.2 or Node >= 24.

Needs TYPESAFE_API_KEY set.

import { evaluate } from "@corbits/system-one";

const result = await evaluate({
  state: { action: "deploy", env: "production" },
  questions: [
    {
      id: "escalate",
      type: "boolean",
      instructions: "Must this request be escalated for human approval?",
    },
  ],
});

console.log(result.fallback ? result.reason : result.decisions);

On success it prints one decision per question, or the fallback reason on failure:

[{ id: "escalate", type: "noul", noul: 0.91 }];

Boolean questions answer as noul, a probability from 0 to 1 that the answer is yes.

Interchange runs AI agents as principals (accounts that hold their own identity, permissions and credentials). Corbits packages add what an agent product needs around it.

• Runs in: the agent sidecar (the runtime next to each agent), or any process. evaluate() needs no Interchange runtime.
• Plugs into: the @intx/inference adapter registry, as the adapter for the corbits-system-one provider id.
• Pairs with: @corbits/openai-responses and @corbits/ollama-adapter, the other Corbits inference providers.

Question, QuestionList, Decision, EvaluateInput, EvaluateConfig, EndpointConfig, EvaluateResult and FallbackResult are exported as arktype schemas and types.

Every question has an id, unique within the list.

input.config for evaluate, or the argument to createSystemOneAdapter:

SYSTEM_ONE_API_KEY is also a supported alias on every endpoint, read after the endpoint's own key.

detail carries the underlying message.

Register the adapter under SYSTEM_ONE_PROVIDER and pass questions per call in providerOptions.systemOne ({ state?, questions? }). Without state, the adapter sends the transcript text as state. Without questions, it asks one boolean question with id response.

import { createDependencies, runInference } from "@intx/inference";
import {
  createSystemOneAdapter,
  SYSTEM_ONE_PROVIDER,
  type QuestionList,
} from "@corbits/system-one";

const deps = createDependencies({
  has: (provider) => provider === SYSTEM_ONE_PROVIDER,
  resolve: () => createSystemOneAdapter(),
});

const questions = [
  {
    id: "escalate",
    type: "boolean",
    instructions: "Must this request be escalated for human approval?",
  },
] satisfies QuestionList;

let seq = 0;
for await (const event of runInference({
  deps,
  source: {
    id: "system-one",
    provider: SYSTEM_ONE_PROVIDER,
    baseURL: "https://api.typesafe.ai/v1/systemone",
    credentialId: "TYPESAFE_API_KEY",
    model: "jev-latest",
  },
  turns: [
    {
      role: "user",
      timestamp: Date.now(),
      content: [{ type: "text", text: "Deploy to production?" }],
    },
  ],
  inferenceOptions: { providerOptions: { systemOne: { questions } } },
  nextSeq: () => seq++,
  readMaterial: (id) => {
    const secret = process.env[id];
    if (secret === undefined) throw new Error(`${id} is not set`);
    return { secret };
  },
})) {
  if (event.type === "inference.text.delta")
    console.log(JSON.parse(event.data.token));
}

The adapter emits one inference.text.delta per decision, whose token is the decision as JSON, then an inference.usage event. The harness supplies the credential through readMaterial and owns retries. A malformed response body is a ProtocolMismatchError, not a fallback.

createSystemOneAdapterFactory(source, quirks?) is an Interchange AdapterFactory, so a stock sidecar loads it from SIDECAR_ADAPTER_MANIFEST with no custom code:

[
  {
    "provider": "corbits-system-one",
    "specifier": "@corbits/system-one",
    "export": "createSystemOneAdapterFactory"
  }
]

The hub offering's quirks are validated and all optional:

{
  "endpoint": {
    "kind": "custom",
    "url": "https://opencode.ai/zen/v1/systemone"
  },
  "model": "jev-1.13",
  "questions": [{ "type": "boolean", "id": "gate", "instructions": "Allow?" }],
  "state": {}
}

Without endpoint, the adapter posts to the catalog provider's baseURL + /systemone, the host the offering's credential was issued for. A model quirk (top level or on endpoint) is the model sent on the wire, so one catalog model can be served by providers that name it differently. questions and state are per-call defaults; providerOptions.systemOne on a call wins field by field. Unknown keys throw. The adapter sends the bearer sentinel and the harness injects the offering's credential.

• createSystemOneAdapterFactory without an endpoint quirk now posts to the catalog provider's baseURL + /systemone instead of the official TypeSafe URL. Set the provider baseURL to the API root (for example https://api.typesafe.ai/v1), or keep the old behavior with {"endpoint":{"kind":"official"}}. The harness sends the offering's credential to whatever URL the adapter returns, so only set an explicit endpoint on a host that credential belongs to.
• A model quirk now overrides the model the harness passes (the catalog canonical name).
• createSystemOneAdapter and evaluate are unchanged.

• HttpError, NetworkError and TimeoutError are removed. Transport failures return a FallbackResult.
• A 2xx body that is not JSON is parse-error (was network). A timeout during the body read is timeout.
• recordTelemetryEvent and drainTelemetryEvents are removed. Pass evaluate(input, { onTelemetry }).
• Wire helpers, quirks presets, JsonRecord, Confidence and the env-var name constants are no longer exported.
• A custom endpoint without a model sends typesafe-ai/jev.
• Peers are @intx/inference and @intx/types ^0.4.0.
• Environment variables are unchanged, including SYSTEM_ONE_API_KEY.

LGPL-2.1-only